istio

Documentation

Overview

Package istio discovers consumers from Istio RequestAuthentication resources (confidence 1.0 — declarative and unambiguous). It reads from static manifests (Discoverer) or, via a client-go dynamic client, live cluster CRDs (InClusterDiscoverer, see incluster.go). Both share the same mapping.

Index

• type Discoverer
  • func New() *Discoverer
  • func (d *Discoverer) Discover(_ context.Context, scope discovery.Scope) ([]model.Consumer, error)
  • func (d *Discoverer) Name() string
  • func (d *Discoverer) WithClock(now func() time.Time) *Discoverer
• type InClusterDiscoverer
  • func NewInCluster(client dynamic.Interface, clusterRef string) *InClusterDiscoverer
  • func (d *InClusterDiscoverer) Discover(ctx context.Context, scope discovery.Scope) ([]model.Consumer, error)
  • func (d *InClusterDiscoverer) Name() string
  • func (d *InClusterDiscoverer) WithClock(now func() time.Time) *InClusterDiscoverer

Types

type Discoverer

type Discoverer struct {
	// contains filtered or unexported fields
}

Discoverer reads Istio security CRDs.

func New

func New() *Discoverer

New constructs an Istio discoverer.

func (*Discoverer) Discover

func (d *Discoverer) Discover(_ context.Context, scope discovery.Scope) ([]model.Consumer, error)

Discover parses RequestAuthentication resources under scope.ConfigPaths and enriches them with required claims from AuthorizationPolicy resources that select the same workload.

func (*Discoverer) Name

func (d *Discoverer) Name() string

Name identifies this source in provenance records.

func (*Discoverer) WithClock

func (d *Discoverer) WithClock(now func() time.Time) *Discoverer

WithClock injects a clock (tests).

type InClusterDiscoverer

type InClusterDiscoverer struct {
	// contains filtered or unexported fields
}

InClusterDiscoverer reads live Istio security CRDs from the Kubernetes API via a dynamic client (KI-02), instead of static manifests. It reuses the exact same mapping as the manifest source, so a consumer derived in-cluster is identical to one derived from the equivalent YAML.

func NewInCluster

func NewInCluster(client dynamic.Interface, clusterRef string) *InClusterDiscoverer

NewInCluster constructs an in-cluster Istio discoverer over the given dynamic client. clusterRef (typically the kube-context) is only used to label provenance; pass "" for an in-cluster (service-account) client.

func (*InClusterDiscoverer) Discover

func (d *InClusterDiscoverer) Discover(ctx context.Context, scope discovery.Scope) ([]model.Consumer, error)

Discover lists RequestAuthentication and AuthorizationPolicy objects from the cluster and maps them to consumers.

func (*InClusterDiscoverer) Name

func (d *InClusterDiscoverer) Name() string

Name identifies this source in provenance records.

func (*InClusterDiscoverer) WithClock

func (d *InClusterDiscoverer) WithClock(now func() time.Time) *InClusterDiscoverer

WithClock injects a clock (tests).